TO: 


Of: 
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Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTICE 


Leads Work Limited 


Suite C Underwood House, 235 Three Bridges Road, Crawley, West 
Sussex, RH10 1LU 


The Information Commissioner (“Commissioner”) has decided to issue 
Leads Work Limited (“LWL”) with an enforcement notice under section 
40 of the Data Protection Act 1998 (“DPA”). The notice is in relation to 
a contravention of Regulation 22 of the Privacy and Electronic 
Communications (EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


LWL, whose registered office is given above (companies house 
registration number: 10853169), is the organisation (person) stated in 
this notice to have transmitted unsolicited communications by means 
of electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR provides that: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has previously 
notified the sender that he consents for the time being to such 


communications being sent by, or at the instigation of, the sender. 


(3) A person may send or instigate the sending of electronic mail for 
the purposes of direct marketing where - 


(a) That person has obtained the contact details of the recipient of 
that electronic mail in the course of the sale or negotiations for 
the sale of a product or device to that recipient; 

(b) The direct marketing is in respect of that person’s similar 
products and services only; and 

(c) The recipient has been given a simple means of refusing (free of 
charge except for the costs of transmission of the refusal) the 
use of his contact details for the purposes of such direct 
marketing, at the time that the details were initially collected, 
and, where he did not initially refuse the use of the details, at the 


time of each subsequent communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 


Section 122(5) of the DPA 2018 defines “direct marketing” as “the 


communication (by whatever means) of any advertising or marketing 
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material which is directed to particular individuals”. This definition also 


applies for the purposes of PECR (see regulation 2(2)). 


“Electronic mail” is defined in regulation 2(1) PECR as “ any text, voice, 
sound or image sent over a public electronic communications network 
which can be stored in the network or in the recipient’s terminal 
equipment until it is collected by the recipient and includes messages 


sent using a short message service”. 


Consent is defined in Article 4(11) the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


The DPA contains enforcement provisions at Part V which are 
exercisable by the Commissioner. Those provisions are modified and 
extended for the purposes of PECR by Schedule 1 PECR. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that if the Commissioner is satisfied that a person has 
contravened or is contravening any of the requirements of the 
Regulations, he may serve him with an Enforcement Notice requiring 
him to take within such time as may be specified in the Notice, or to 
refrain from taking after such time as may be so specified, such steps 


as are so specified. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of part 9, Schedule 20 of that Act). 
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The contravention 


The Commissioner finds that LWL has contravened Regulation 22 of 


PECR. The Commissioner finds that the contravention was as follows: 


Between 16 May 2020 and 26 June 2020 LWL transmitted 2,670,140 
texts over a public electronic communications network by means of 
electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


Organisations cannot generally send marketing texts unless the 
recipient has notified the sender that they consent to such texts being 


sent by, or at the instigation of, that sender. 


The Commissioner is therefore satisfied that the consent relied on by 
LWL did not amount to valid consent for the purposes of regulation 22 
PECR. 


The Commissioner is satisfied that LWL was responsible for this 


contravention. 


LWL has continued to send marketing texts to individuals without any 
apparent remedial measures having been taken to prevent further 
contraventions of Regulation 22. This is evidenced by a further 28,350 
complaints received by the 7726 reporting service since August 2020 


to the time of this Notice. 


The Commissioner has considered, as she is required to do under 
section 40(2) of the DPA (as extended and modified by the 
Regulations) when deciding whether to serve an Enforcement Notice, 


whether any contravention has caused or is likely to cause any person 
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damage. The Commissioner has decided that it is unlikely that actual 


damage has been caused in this instance. 


18. In view of the matters referred to above the Commissioner 
hereby gives notice that, in exercise her powers under section 
40 of the Act she requires LWL to take the steps as specified in 


Annex 1 of this Notice. 


Rights of Appeal 


19. There is aright of Appeal against this Notice to the First-Tier Tribunal 
(Information Rights), part of the General Regulatory Chamber. 


Information about appeals is set out in the attached Annex 2. 


Dated the 1st day of March 2020 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 SAF 
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ANNEX 1 
TERMS OF THE ENFORCEMENT NOTICE 
LWL shall within 30 days of the date of this Notice: 


Except in the circumstances referred to in paragraph (3) of regulation 22 of 
PECR, neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of electronic 
mail unless the recipient of the electronic mail has previously notified LWL 
that he clearly and specially consents for the time being to such 


communications being sent by, or at the instigation of, LWL. 
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RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 48 of the Data Protection Act 1998 gives any person upon whom 
an enforcement notice has been served a right of appeal to the First-tier 


Tribunal (Information Rights) (the “Tribunal”) against the notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in accordance 
with the law; or 
b) to the extent that the notice involved an exercise of discretion by the 


Commissioner, that she ought to have exercised her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as could 
have been made by the Commissioner. In any other case the Tribunal will 
dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal at 


the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 

Telephone: 0300 123 4504 


Email: grc@justice.gov.uk 
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e The notice of appeal should be served on the Tribunal within 28 days of the 


date on which the enforcement notice was sent. 


4. The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure (First- 
tier Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory 
Instrument 2009 No. 1976 (L.20)). 


